<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook V4.1//EN"
[
  <!ENTITY intro SYSTEM "intro.sgml">
  <!ENTITY before.we.start SYSTEM "before_we_start.sgml">
  <!ENTITY magic.of.elf SYSTEM "magic_of_elf.sgml">
  <!ENTITY readelf SYSTEM "readelf.sgml">
  <!ENTITY one.step.closer SYSTEM "one_step_closer.sgml">
  <!ENTITY entry.point SYSTEM "entry_point.sgml">
  <!ENTITY rst SYSTEM "rst.sgml">
  <!ENTITY additional.cs SYSTEM "additional_cs.sgml">
  <!ENTITY doing.it.in.c SYSTEM "doing_it_in_c.sgml">
  <!ENTITY revision.history SYSTEM "revision_history.sgml">

  <!ENTITY % calc SYSTEM "out/calc.sgml">
  %calc;

  <!ENTITY http.main.site "http://wildsau.idv.uni-linz.ac.at/~k3032e4">

  <!ENTITY http.jargon "http://www.tuxedo.org/~esr/jargon/html/entry/">
  <!ENTITY http.jargon.backdoor "&http.jargon;back-door.html">
  <!ENTITY http.jargon.buffer.overflow "&http.jargon;buffer-overflow.html">
  <!ENTITY http.jargon.exploit "&http.jargon;exploit.html">
  <!ENTITY http.jargon.FUD "&http.jargon;FUD.html">
  <!ENTITY http.jargon.RTFM "&http.jargon;RTFM.html">
  <!ENTITY http.jargon.script.kiddies "&http.jargon;script-kiddies.html">
  <!ENTITY http.jargon.trojan "&http.jargon;Trojan-horse.html">
  <!ENTITY http.jargon.virus "&http.jargon;virus.html">
  <!ENTITY http.jargon.worm "&http.jargon;worm.html">

  <!ENTITY http.list.linuxdoc
    "http://list.linuxdoc.org/archive/index.htm?1">
  <!ENTITY http.silvio.cesare "http://www.big.net.au/~silvio">
  <!ENTITY http.nasm.site "http://nasm.2y.net">
  <!ENTITY ftp.elf.spec.canonical
    "ftp://tsx.mit.edu/pub/linux/packages/GCC/ELF.doc.tar.gz">
  <!ENTITY http.elf.spec.flat.text
    "http://www.muppetlabs.com/~breadbox/software/ELF.txt">
  <!ENTITY http.teensy.executables
    "http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html">
  <!ENTITY http.linuxassembly.startup
    "http://linuxassembly.org/startup.html">

  <!ENTITY http.securiteam "http://www.securiteam.com">
  <!ENTITY http.securiteam.5MP022K5GE
    "&http.securiteam;/unixfocus/5MP022K5GE.html">

  <!ENTITY http.vmyths "http://vmyths.com">
  <!ENTITY http.vmyths.osama "&http.vmyths;/rant.cfm?id=410&amp;page=4">

  <!ENTITY http.newsbytes "http://www.newsbytes.com">
  <!ENTITY http.newsbytes.02.173408 "&http.newsbytes;/news/02/173408.html">

  <!ENTITY http.vnunet "http://www.vnunet.com">
  <!ENTITY http.vnunet.1127965 "&http.vnunet;/News/1127965">

  <!ENTITY http.cert "http://www.cert.org">
  <!ENTITY linuxdoc "http://www.linuxdoc.org">
  <!ENTITY linuxdoc.security.HOWTO "&linuxdoc;/HOWTO/Security-HOWTO.html">
  <!ENTITY linuxdoc.security.HOWTO.10 "&linuxdoc;/HOWTO/Security-HOWTO-10.html">

  <!ENTITY faqs.org "http://www.faqs.org/faqs">
  <!ENTITY faq.unix "&faqs.org;/unix-faq/faq">
  <!ENTITY faq.suicide.methods "&faqs.org;/suicide_methods">

  <!ENTITY http.qualys "http://www.qualys.com">
  <!ENTITY http.newsforge "http://newsforge.com">
  <!ENTITY http.newsforge.181122
    "&http.newsforge;/article.pl?sid=02/01/25/1811226&amp;mode=thread">
  <!ENTITY http.sourceforge "http://www.sourceforge.org">
  <!ENTITY http.freshmeat "http://www.freshmeat.net">

  <!ENTITY http.virus.plural "http://www.perl.com/language/misc/virus.html">
]>
<article id="index">

<articleinfo>
  <title>The Linux Virus Writing HOWTO</title>
  <titleabbrev>TLVWH</titleabbrev>
  <subtitle>
    post link-time code modification of ELF executables under Linux/i386
  </subtitle>

  <author>
    <firstname>Alexander</firstname>
    <surname>Bartolich</surname>
    <affiliation>
      <address>
	<email>alexander.bartolich@gmx.at</email>
      </address>
    </affiliation>
  </author>

  <abstract>
    <simpara>
      This document describes how to write parasitic file viruses
      infecting ELF executables on Linux/i386. Though it contains a
      lot of source code, no actual virus is included.
      Every mentioned infection method is accompanied with a practical
      guide to detection.
    </simpara>
  </abstract>

  <copyright>
    <year>2002</year>
    <holder>Alexander Bartolich</holder>
  </copyright>

  <revhistory>
    <revision>
      <revnumber>
        <link linkend="rev.2002.04.13"
	  >A doomed ship should sail under a courageous flag.</link>
      </revnumber>
      <date>2002-04-13</date>
      <revremark>
	Changed license, title, stylesheet and some SGML-tags.
	Finished <link linkend="doing.it.in.C">Doing it in C</link>.
      </revremark>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.04.09"
	  >Sinners can repent, but stupid is forever.</link>
      </revnumber>
      <date>2002-04-09</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.04.06"
	  >Deliver yesterday, code today, think tomorrow.</link>
      </revnumber>
      <date>2002-04-06</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.04.01">
	  Be different: conform.
	</link>
      </revnumber>
      <date>2002-04-01</date>
    </revision>
    
    <revision>
      <revnumber>
        <link linkend="rev.2002.03.28"
	  >As a computer, I find your faith in technology amusing.</link>
      </revnumber>
      <date>2002-03-28</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.24"
	  >Caution: Keep out of reach of children.</link>
      </revnumber>
      <date>2002-03-24</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.20"
	  >Calm down, it's *only* ones and zeroes.</link>
      </revnumber>
      <date>2002-03-20</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.19"
	  >What we do not understand we do not possess.</link>
      </revnumber>
      <date>2002-03-19</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.17"
	  >What we do not understand we do not possess.</link>
      </revnumber>
      <date>2002-03-17</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.15"
	  >I predict that today will be remembered until tomorrow.</link>
      </revnumber>
      <date>2002-03-15</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.14">Genie escaped the bottle.</link>
      </revnumber>
      <date>2002-03-14</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.11"
	  >Unfinished excerpt sent to David C. Merrill.</link>
      </revnumber>
      <date>2002-03-11</date>
    </revision>

    <revision>
      <revnumber>
        <link linkend="rev.2002.03.09"
	  >Unfinished excerpt sent to Linux Documentation Project.</link>
      </revnumber>
      <date>2002-03-09</date>
    </revision>

  </revhistory>

</articleinfo>

<sect1 id="intro" xreflabel="Introduction">
  <title>Introduction</title>
  &intro;
</sect1>
<sect1 id="before.we.start" xreflabel="Before we start">
  <title>Before we start</title>
  &before.we.start;
</sect1>
<sect1 id="magic.of.elf" xreflabel="The magic of the Elf">
  <title>The magic of the Elf</title>
  &magic.of.elf;
</sect1>
<sect1 id="readelf" xreflabel="readelf">
  <title>readelf</title>
  &readelf;
</sect1>
<sect1 id="one.step.closer" xreflabel="One step closer to the edge">
  <title>One step closer to the edge</title>
  &one.step.closer;
</sect1>
<sect1 id="entry.point" xreflabel="The entry point">
  <title>The entry point</title>
  &entry.point;
</sect1>
<sect1 id="rst" xreflabel="Remote shell trojan (RST)">
  <title>Remote shell trojan (RST)</title>
  &rst;
</sect1>
<sect1 id="additional.cs" xreflabel="Additional code segments">
  <title>Additional code segments</title>
  &additional.cs;
</sect1>
<sect1 id="doing.it.in.c" xreflabel="Doing it in C">
  <title>Doing it in C</title>
  &doing.it.in.c;
</sect1>

<appendix id="revision.history">
  <title>Revision history</title>
  &revision.history;
</appendix>

<appendix id="license.FDL" xreflabel="GNU Free Documentation License">
  <title>GNU Free Documentation License</title>
  <!--
   ! 2002-04-11 Alexander Bartolich
   ! A plain mediobject produces unreadable text without
   ! line breaks or paragraps on my RedHat 7.2 setup.
  -->
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../FDL.txt" format="linespecific"
  ></imageobject></inlinemediaobject></programlisting>
</appendix>

<appendix id="license.GPL" xreflabel="GNU General Public License">
  <title>GNU General Public License</title>
  <programlisting><inlinemediaobject><imageobject><imagedata
    fileref="../GPL.txt" format="linespecific"
  ></imageobject></inlinemediaobject></programlisting>
</appendix>

</article>
